Don't hard-code the number of compression utility arguments.
The zstd invocation constructed by newsyslog contains one more parameter than invocations for the other supported compression utilities. However, the maximum number of arguments was hard-coded, leading to an out-of-bounds array access when using zstd compression.
This commit is contained in:
parent
995cd89924
commit
322dacf057
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=337050
@ -153,23 +153,24 @@ struct compress_types {
|
|||||||
const char *suffix; /* Compression suffix */
|
const char *suffix; /* Compression suffix */
|
||||||
const char *path; /* Path to compression program */
|
const char *path; /* Path to compression program */
|
||||||
char **args; /* Compression program arguments */
|
char **args; /* Compression program arguments */
|
||||||
|
int nargs; /* Program argument count */
|
||||||
};
|
};
|
||||||
|
|
||||||
static char f_arg[] = "-f";
|
static char f_arg[] = "-f";
|
||||||
static char q_arg[] = "-q";
|
static char q_arg[] = "-q";
|
||||||
static char rm_arg[] = "--rm";
|
static char rm_arg[] = "--rm";
|
||||||
static char *gz_args[] ={ NULL, f_arg, NULL, NULL };
|
static char *gz_args[] = { NULL, f_arg, NULL, NULL };
|
||||||
#define bzip2_args gz_args
|
#define bz2_args gz_args
|
||||||
#define xz_args gz_args
|
#define xz_args gz_args
|
||||||
static char *zstd_args[] = { NULL, q_arg, rm_arg, NULL, NULL };
|
static char *zstd_args[] = { NULL, q_arg, rm_arg, NULL, NULL };
|
||||||
|
|
||||||
#define ARGS_NUM 4
|
#define ARGS_NUM 5
|
||||||
static const struct compress_types compress_type[COMPRESS_TYPES] = {
|
static const struct compress_types compress_type[COMPRESS_TYPES] = {
|
||||||
{ "", "", "", NULL}, /* none */
|
{ "", "", "", NULL, 0},
|
||||||
{ "Z", COMPRESS_SUFFIX_GZ, _PATH_GZIP, gz_args}, /* gzip */
|
{ "Z", COMPRESS_SUFFIX_GZ, _PATH_GZIP, gz_args, nitems(gz_args) },
|
||||||
{ "J", COMPRESS_SUFFIX_BZ2, _PATH_BZIP2, bzip2_args}, /* bzip2 */
|
{ "J", COMPRESS_SUFFIX_BZ2, _PATH_BZIP2, bz2_args, nitems(bz2_args) },
|
||||||
{ "X", COMPRESS_SUFFIX_XZ, _PATH_XZ, xz_args }, /* xz */
|
{ "X", COMPRESS_SUFFIX_XZ, _PATH_XZ, xz_args, nitems(xz_args) },
|
||||||
{ "Y", COMPRESS_SUFFIX_ZST, _PATH_ZSTD, zstd_args } /* zst */
|
{ "Y", COMPRESS_SUFFIX_ZST, _PATH_ZSTD, zstd_args, nitems(zstd_args) }
|
||||||
};
|
};
|
||||||
|
|
||||||
struct conf_entry {
|
struct conf_entry {
|
||||||
@ -2027,23 +2028,24 @@ do_zipwork(struct zipwork_entry *zwork)
|
|||||||
char zresult[MAXPATHLEN];
|
char zresult[MAXPATHLEN];
|
||||||
char command[BUFSIZ];
|
char command[BUFSIZ];
|
||||||
char **args;
|
char **args;
|
||||||
int c, i;
|
int c, i, nargs;
|
||||||
|
|
||||||
assert(zwork != NULL);
|
assert(zwork != NULL);
|
||||||
pgm_path = NULL;
|
pgm_path = NULL;
|
||||||
strlcpy(zresult, zwork->zw_fname, sizeof(zresult));
|
strlcpy(zresult, zwork->zw_fname, sizeof(zresult));
|
||||||
args = calloc(ARGS_NUM, sizeof(*args));
|
|
||||||
if (args == NULL)
|
|
||||||
err(1, "calloc()");
|
|
||||||
if (zwork->zw_conf != NULL &&
|
if (zwork->zw_conf != NULL &&
|
||||||
zwork->zw_conf->compress > COMPRESS_NONE)
|
zwork->zw_conf->compress > COMPRESS_NONE)
|
||||||
for (c = 1; c < COMPRESS_TYPES; c++) {
|
for (c = 1; c < COMPRESS_TYPES; c++) {
|
||||||
if (zwork->zw_conf->compress == c) {
|
if (zwork->zw_conf->compress == c) {
|
||||||
|
nargs = compress_type[c].nargs;
|
||||||
|
args = calloc(nargs, sizeof(*args));
|
||||||
|
if (args == NULL)
|
||||||
|
err(1, "calloc()");
|
||||||
pgm_path = compress_type[c].path;
|
pgm_path = compress_type[c].path;
|
||||||
(void) strlcat(zresult,
|
(void) strlcat(zresult,
|
||||||
compress_type[c].suffix, sizeof(zresult));
|
compress_type[c].suffix, sizeof(zresult));
|
||||||
/* the first argument is always NULL, skip it */
|
/* the first argument is always NULL, skip it */
|
||||||
for (i = 1; i < ARGS_NUM; i++) {
|
for (i = 1; i < nargs; i++) {
|
||||||
if (compress_type[c].args[i] == NULL)
|
if (compress_type[c].args[i] == NULL)
|
||||||
break;
|
break;
|
||||||
args[i] = compress_type[c].args[i];
|
args[i] = compress_type[c].args[i];
|
||||||
|
Loading…
Reference in New Issue
Block a user